feat: Add LUKS encryption using IBM Crypto Express Card #1542
Description
Hi,
We would like to enable IBM Crypto Express card (CEX) luks encryption in bootc. The cex based luks encryption feature has been enabled from 4.19. We added this feature in the Ignition which takes care of the luks encryption.
Here are the few highlight and working part specific to CEX based luks encryption.
1. A key slot in luks2 header stores a wrapped copy of the volume key,where the wrapping key is derived from the users passphrase or "keyfile".
2. In the infrastructure for protected volume encryption, the luks2 volume key is secure key.
3. The effective volume is twofold protected: it is encrypted by an AES master key
from a CCA or EP11 coProcessor and by a wrapping key or KEK derived from a passphrase or "keyfile".
4. Therefore to unlock a luks2 volume a passphrase - provided interactively or from this "keyfile"
is required to decrypt the outer wrapping.
5. The security provided by the passphrase or "keyfile" is typically much lower than that provided by the wrapping AES master key.
6. Therefore the password or "keyfile" may be exposed without any loss of security.
7. When a secure key for the PAES cipher is provide to dm-crypt inorder to open a volume,
it automatically transforms this secure key into a protected key that can be interpreted by the CPACF.
8. The actual effective key of the luks2 volume key is never exposed to the operating system.
The following figure show how the Secure keys get generated.
1. A secure key is created by using a zkey command. The zkey utility generates the secure key with the help of the pkey utility and an assigned Crypto Express adapter (with master key). The secure key is also stored in the key repository.
2. The use of the zkey cryptsetup command generates output strings that are copied and pasted to the cryptsetup command to create the encrypted volume with the appropriate secure key.
3. The cryptsetup utility formats the physical volume and writes the encrypted secure key and cipher information to the LUKS2 header of the volume.
To Open the Luks Device
1. The cryptsetup utility fetches the secure key from the LUKS2 header.
2. The cryptsetup utility passes the secure key to dm-crypt.
3. The dm-crypt passes the secure key to paes for conversion into a protected key by using pkey.
4. The pkey module starts the process for converting the secure key to a protected key.
5. The secure key is unwrapped by the CCA coprocessor in the Crypto Express adapter by
using the master key.
6. The unwrapped secure key (effective key) is rewrapped by using a transport key that is specific to the assigned domain ID.
7. By using firmware, CPACF creates a protected key and sends it to the pkey module for volume read/write usage with paes and dm-crypt.